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-- The MAILING DATE of this communication appears on the cover sheet with the correspondence address -- 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C, § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)S Responsive to communication(s) filed on 26 September 2003 . 
2a)S This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-49 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) S Claim(s) 49 is/are allowed. 

6) S Claim(s) 1-6. 14. 19-31 and 35-48 is/are rejected. 

7) S Claim(s) 7-13.15-18 and 32-34 is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)\3 objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
Priority under 35 U.S.C. §§119 and 120 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (0- 
a)DAII b)D Some*c)D None of: 

Certified copies of the priority documents have been received. 
Certified copies of the priority documents have been received in Application No. . 



1. D 

2. D 
3-D 



Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

13) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 119(e) (to a provisional application) 

since a specific reference was included in the first sentence of the specification or in an Application Data Sheet. 
37 CFR 1.78. 

a) D The translation of the foreign language provisional application has been received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121 since a specific 

reference was included in the first sentence of the specification or in an Application Data Sheet. 37 CFR 1.78. 
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DETAILED ACTION 



Response to Arguments 



Applicant's arguments filed September 25, 2003 have been fully considered but 
they are not persuasive. 

Applicant argues independent claims 1 , 37 and 39 have the advantage of a 
subject being authenticated without sharing the biometric data with an external 
comparison device. 

In response to applicant's argument that the references fail to show certain 
features of applicant's invention, it is noted that the features upon which applicant relies 
(i.e., the subject can be authenticated without sharing the biometric data with an 
external comparison device) are not recited in the rejected claim(s). Although the 
claims are interpreted in light of the specification, limitations from the specification are 
not read into the claims. See In re Van Geuns, 988 F.2d 1 181 , 26 USPQ2d 1057 (Fed. 
Cir. 1993). 

Applicant suggests the language of "without sharing any of the subject's 
biometric data" clearly conveys the idea of the subject being authenticated without 
sharing the biometric data with an external comparison device. Examiner contends the 
language does not clearly convey that idea. More specifically, page 5, lines 13-17 of 
applicant's specification, appears to be different from what applicant is arguing in that 
the section appears to be focused on preventing a party who is requesting 
authentication from gaining the authentication information, while the amendment is 




Application/Control Number: 09/372,170 Page 3 

Art Unit: 2134 

focused on preventing an external device performing an authentication comparison from 
acquiring the subject's biometric data. Because of the above the language is not clearly 
conveying applicant's inventive concept. 

Applicant argues there is no suggestion or teaching of maintaining confidentiality 
and withholding authentication information from another party. Examiner contends 
Burger does teach preventing hacking and sniffing of authentication information while 
the information is being compared by not allowing any communication to or from a 
remote location (CPU) or any other device (see column 6, lines 1-8). 

For the above reasons, the examiner maintains the rejections given below. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the 
United States before the invention thereof by the applicant for patent, or on an international application 
by another who has fulfilled the requirements of paragraphs (1 ), (2), and (4) of section 371 (c) of this 
title before the invention thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act 
of 1999 (AIPA) and the Intellectual Property and High Technology Technical 
Amendments Act of 2002 do not apply when the reference is a U.S. patent resulting 
directly or indirectly from an international application filed before November 29, 2000. 
Therefore, the prior art date of the reference is determined under 35 U.S.C. 102(e) prior 
to the amendment by the AIPA (pre-AlPA 35 U.S.C. 102(e)). 
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Claims 1-3, 5-6, 14, 20, 24-27, 30, 31, 35, 37, 39-45, 47 and 48 are rejected 
under 35 U.S.C. 102(e) as being anticipated by U.S. patent 6,219,439 granted to 
Burger. 

Regarding claim 1 , Burger meets the claimed limitations as follows: 
"A method of authenticating a subject, comprising: using one or a plurality of biometric 
measurements for authentication without any sharing of the subject's biometric data." 
see column 5, line 66 to column 6, line 8 and column 6, lines 63-67. 

Regarding claim 2, Burger meets the claimed limitations as follows: 
"The method according to claim 1, further comprising: storing said biometric data in an 
individual unit, said individual unit belonging to said subject." see column 6, lines 39-42. 

Regarding claim 3, Burger meets the claimed limitations as follows: 
"The method according to claim 2, wherein said individual unit is portable for being 
carried by said subject." see column 4, lines 34-42. 

Regarding claim 5, Burger meets the claimed limitations as follows: 
"The method according to claim 2, wherein said individual unit comprises one of a smart 
card, a personal area network (PAN) tool, and an apparatus linked to a network." see 
column 6, lines 14-34. 

Regarding claim 6, Burger meets the claimed limitations as follows: 
"The method according to claim 1 , further comprising: 

after said authentication, selectively obtaining access to any of a location, a service, and 
an option in a service by said subject." see column 6, lines 39-51 and column 8, lines 
16-34. 




Application/Control Number: 09/372,170 Page 5 

Art Unit: 2134 

Regarding claim 14, Burger meets the claimed limitations as follows: 
"A method of authenticating a characteristic of a subject, without compromising privacy 
of the subject, comprising: using at least one of a plurality of authentication methods 
including personal information of the subject, a biometric of the subject, a password, a 
personal identification number (PIN) and a secured component; and simultaneously with 
said using, said subject maintaining confidentiality of authentication information and 
withholding said authentication information from the other party." see column 5, line 66 
to column 6, line 8 and column 6, lines 63-67. 

Regarding claim 20, Burger meets the claimed limitations as follows: 
"A method for secure authentication of a subject, comprising: selectively requesting any 
of a password and a knowledge-based information from said subject; and 
simultaneously with said selectively requesting, interrogating biometric information of 
the subject, said biometric information being carried by said subject." see column 5, line 
66 to column 6, line 8 and column 6, lines 63-67. 

Regarding claim 24, Burger meets the claimed limitations as follows: 
"The method according to claim 20, wherein a device is carried by the subject to be 
authorized to perform a task, wherein at a moment of authorization, said device is 
presented to a reader of an authorizing machine of an entity seeking authentication, 
which prompts said device for a password for authorization to be given, and wherein 
said device reads a biometric of said subject using a sensor included in the device and 
computes the password." see column 5, lines 42-65. 

Regarding claim 25, Burger meets the claimed limitations as follows: 
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"The method according to claim 24, wherein said device allows the password to be read 
by the authorizing machine." see column 5, lines 42-65. 

Regarding claim 26, Burger meets the claimed limitations as follows: 
"The method according to claim 25, wherein said password is read in a contacting 
manner." see column 5, lines 50-55. 

Regarding claim 27, Burger meets the claimed limitations as follows: 
"The method according to claim 25, wherein said password is read in a contact-free 
manner." see column 5, lines 50-55. 

Regarding claim 30, Burger meets the claimed limitations as follows: 
"The method according to claim 24, further comprising: storing on the device information 
regarding a previous authentication including a biometric-print of the subject." see 
column 4, lines 5-13 and column 6, lines 39-47. 

Regarding claim 31, Burger meets the claimed limitations as follows: 
"The method according to claim 20, further comprising: encrypting a biometric-print 
using the subject's biometric and personal knowledge onto a device carried by said 
subject." see column 4, lines 5-13 and column 7, lines 1-3. 

Regarding claim 35, Burger meets the claimed limitations as follows: 
"An apparatus for secure authentication, without compromising privacy of a subject, 
comprising: a reader, associated with the subject, for reading a specified biometric of 
said subject; and a password generator for producing a password needed based on 
said biometric." see column 5, line 66 to column 6, line 8 and column 6, lines 63-67. 

Regarding claim 37, Burger meets the claimed limitations as follows: 
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"An apparatus for secure authentication, comprising: means, associated with a subject, 
for reading a specified biometric of said subject; and means for producing a password 
needed based on said biometric, without providing access to said biometric by anyone 
other than said subject" see column 5, line 66 to column 6, line 8 and column 6, lines 
63-67. 

Regarding claim 39, Burger meets the claimed limitations as follows: 
"A method of identifying a subject, comprising: using one or a plurality of biometric 
measurements for identification without any sharing of the subject's biometric data." see 
column 5, line 42 to column 6, line 8 and column 6, lines 63-67. 

Regarding claim 40, Burger meets the claimed limitations as follows: 
"The method of claim 39, wherein a subject's identity is determined locally, under the 
subject's control, by having the subject provide at least one of a user ID and by 
biometric identification of the subject among enrolled authorized subjects, and wherein 
said identification produces a set of N best matches for N subsets, and an index formed 
by concatenation of the N indices uniquely identifies the subject." see column 5, lines 
42-63. 

Regarding claim 41, Burger meets the claimed limitations as follows: 
"A method for identification of a subject, comprising: selectively requesting any of a 
password and a knowledge-based information from said subject; and simultaneously 
with said selectively requesting, interrogating biometric information of the subject, said 
biometric information being carried by said subject." see column 5, line 42 to column 6, 
line 8 and column 6, lines 63-67. 
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Regarding claim 42, Burger meets the claimed limitations as follows: 
"The method of claim 41 , wherein a subject's identity is determined locally, under the 
subject's control, by having the subject provide at least one of a user ID and by 
biometric identification of the subject among enrolled authorized subjects, and wherein 
said identification produces a set of N best matches for N subsets, and an index formed 
by concatenation of the N indices uniquely identifies the subject." see column 5, lines 
42-63. 

Regarding claim 43, Burger meets the claimed limitations as follows: 
"An apparatus for identification of a subject, comprising: a reader, associated with the 
subject, for reading a specified biometric of said subject; and a password generator for 
producing a password needed based on said biometric." see column 5, line 66 to 
column 6, line 8 and column 6, lines 63-67. 

Regarding claim 44, Burger meets the claimed limitations as follows: 
"The apparatus according to claim 43, further comprising: means for storing data of said 
biometric in an individual unit, said individual unit belonging to said subject." see column 
6, lines 39^2. 

Regarding claim 45, Burger meets the claimed limitations as follows: 
"The apparatus according to claim 44, wherein said individual unit is portable for being 
carried by said subject." see column 4, lines 34-42. 

Regarding claim 47, Burger meets the claimed limitations as follows: 
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"The apparatus according to claim 44, wherein said individual unit comprises one of a 
smart card, a personal area network (PAN) tool, and an apparatus linked to a network." 
see column 6, lines 14-34. 

Regarding claim 48, Burger meets the claimed limitations as follows: 
"The apparatus according to claim 44, wherein a subject's identity is determined locally, 
under the subject's control, by having the subject provide at least one of a user ID and 
by biometric identification of the subject among enrolled authorized subjects being read 
by said reader, and wherein said identification produces a set of N best matches for N 
subsets, and an index formed by concatenation of the N indices uniquely identifies the 
subject." see column 5, lines 42-63. 

Claims 1-2, 4, 14, 19-23, 28-29, 35-44, 46 and 48 are rejected under 35 
U.S.C. 102(e) as being anticipated by U.S. patent 6,038,315 granted to Strait et al. 

Regarding claim 1, Strait meets the claimed limitations as follows: 
"A method of authenticating a subject, comprising: using one or a plurality of biometric 
measurements for authentication without any sharing of the subject's biometric data." 
see column 2, lines 53-56; column 3, lines 44-64 and column 5, line 47 to column 6, line 
11. 

Regarding claim 2, Strait meets the claimed limitations as follows: 
"The method according to claim 1, further comprising: storing said biometric data in an 
individual unit, said individual unit belonging to said subject." see column 3, lines 47-55 ( 
. . . database . . .). 
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Regarding claim 4, Strait meets the claimed limitations as follows: 
"The method according to claim 2, wherein said individual unit is non-portable." see 
column 3, lines 47-55 and Figure 2. 

Regarding claim 14, Strait meets the claimed limitations as follows: 
"A method of authenticating a characteristic of a subject, without compromising privacy 
of the subject, comprising: using at least one of a plurality of authentication methods 
including personal information of the subject, a biometric of the subject, a password, a 
personal identification number (PIN) and a secured component; and simultaneously with 
said using, said subject maintaining confidentiality of authentication information and 
withholding said authentication information from the other party." see column 2, lines 
53-56; column 3, lines 44-64 and column 5, line 47 to column 6, line 11. 

Regarding claim 19, Strait meets the claimed limitations as follows: 
"The method according to claim 14, further comprising: selectively completing the 
authentication with a remote service using a communication port and protocol." see 
column 6, lines 36-46. 

Regarding claim 20, Strait meets the claimed limitations as follows: 
"A method for secure authentication of a subject, comprising: selectively requesting any 
of a password and a knowledge-based information from said subject; and 
simultaneously with said selectively requesting, interrogating biometric information of 
the subject, said biometric information being carried by said subject." see column 2, 
lines 53-56; column 3, lines 44-64 and column 5, line 47 to column 6, line 1 1 . 

Regarding claim 21 , Strait meets the claimed limitations as follows: 
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"The method according to claim 20, further comprising: using said biometric information 
to generate said password." see abstract. 

Regarding claim 22, Strait meets the claimed limitations as follows: 
"The method according to claim 20, further comprising: performing biometric data 
verification by a device associated with said subject, wherein said biometric data 
verification activates a password controlled authentication mechanism which transfers 
information, but which withholds sufficient information so that the biometric is not 
revealed, to a party requiring authentication." see column 2, lines 53-56; column 3, lines 
44-64 and column 5, line 47 to column 6, line 1 1 . 

Regarding claim 23, Strait meets the claimed limitations as follows: 
"The method according to claim 21, wherein obtaining said password is performed by 
using at least one of an encryption and secure hashing." see column 2, lines 53-56 and 
column 5, line 37 to column 6, line 35. 

Regarding claim 28, Strait meets the claimed limitations as follows: 
"The method according to claim 24, further comprising: using one of a hashing and a 
mapping technique, which is stable with respect to variations of the biometric extracted, 
said using including mapping regions of a biometric-print space, to the password having 
been computed." see column 3, lines 5-64 and Figure 2. 

Regarding claim 29, Strait meets the claimed limitations as follows: 
"The method according to claim 28, wherein said using includes: measuring a 
biometric-print of the subject by ranking biometric prints of N subsets of M biometrics, 
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wherein an index of a top ranking of each of the N subsets is used in computing the 
password." see column 3, lines 5-64 and Figure 2. 

Regarding claim 35, Strait meets the claimed limitations as follows: 
"An apparatus for secure authentication, without compromising privacy of a subject, 
comprising: a reader, associated with the subject, for reading a specified biometric of 
said subject; and a password generator for producing a password needed based on 
said biometric." see column 2, lines 53-56; column 3, lines 44-64 and column 5, line 47 
to column 6, line 11. 

Regarding claim 36, Strait meets the claimed limitations as follows: 
"The apparatus according to claim 35, wherein said password generator includes an 
encryption device using at least one of encryption and secure hashing." see column 2, ^ 
lines 53-56 and column 5, line 37 to column 6, line 35. 

Regarding claim 37, Strait meets the claimed limitations as follows: 
"An apparatus for secure authentication, comprising: means, associated with a subject, 
for reading a specified biometric of said subject; and means for producing a password 
needed based on said biometric, without providing access to said biometric by anyone 
other than said subject." see column 2, lines 53-56; column 3, lines 44-64 and column 5, 
line 47 to column 6, line 1 1 . 

Regarding claim 38, Strait meets the claimed limitations as follows: 
"The apparatus according to claim 37, wherein said means for producing said password 
includes an encryption device using at least one of encryption and secure hashing." see 
column 2, lines 53-56 and column 5, line 37 to column 6, line 35. 
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Regarding claim 39, Strait meets the claimed limitations as follows: 
"A method of identifying a subject, comprising: using one or a plurality of biometric 
measurements for identification without any sharing of the subject's biometric data." see 
column 2, lines 53-56; column 3, lines 44-64 and column 5, line 47 to column 6, line 1 1 . 

Regarding claim 40, Strait meets the claimed limitations as follows: 
"The method of claim 39, wherein a subject's identity is determined locally, under the 
subject's control, by having the subject provide at least one of a user ID and by 
biometric identification of the subject among enrolled authorized subjects, and wherein 
said identification produces a set of N best matches for N subsets, and an index formed 
by concatenation of the N indices uniquely identifies the subject." see column 3, lines 5- 
64 and Figure 2. 

Regarding claim 41, Strait meets the claimed limitations as follows: 
"A method for identification of a subject, comprising: selectively requesting any of a 
password and a knowledge-based information from said subject; and simultaneously 
with said selectively requesting, interrogating biometric information of the subject, said 
biometric information being carried by said subject." see column 2, lines 53-56; column 
3, lines 44-64 and column 5, line 47 to column 6, line 1 1 . 

Regarding claim 42, Strait meets the claimed limitations as follows: 
"The method of claim 41 , wherein a subject's identity is determined locally, under the 
subject's control, by having the subject provide at least one of a user ID and by 
biometric identification of the subject among enrolled authorized subjects, and wherein 
said identification produces a set of N best matches for N subsets, and an index formed 
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by concatenation of the N indices uniquely identifies the subject." see column 3, lines 5- 
64 and Figure 2. 

Regarding claim 43, Strait meets the claimed limitations as follows: 
"An apparatus for identification of a subject, comprising: a reader, associated with the 
subject, for reading a specified biometric of said subject; and a password generator for 
producing a password needed based on said biometric." see column 2, lines 53-56; 
column 3, lines 44-64 and column 5, line 47 to column 6, line 11. 

Regarding claim 44, Burger meets the claimed limitations as follows: 
"The apparatus according to claim 43, further comprising: means for storing data of said 
biometric in an individual unit, said individual unit belonging to said subject." see column 
3, lines 47-55 ( . . . database . . .). 

Regarding claim 46, Strait meets the claimed limitations as follows: 
"The method according to claim 2, wherein said individual unit is non-portable" see 
column 3, lines 47-55 and Figure 2. 

Regarding claim 48, Burger meets the claimed limitations as follows: 
"The apparatus according to claim 44, wherein a subject's identity is determined locally, 
under the subject's control, by having the subject provide at least one of a user ID and 
by biometric identification of the subject among enrolled authorized subjects being read 
by said reader, and wherein said identification produces a set of N best matches for N 
subsets, and an index formed by concatenation of the N indices uniquely identifies the 
subject." see column 3, lines 5-64 and Figure 2. 
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Allowable Subject Matter 



Claim 49 is allowed. 

The following is an examiner's statement of reasons for allowance: The prior art, 
Burger (US 6,219,439) and Strait (US 6,038,315) fail to specifically teach an 
authenticating apparatus that has a biometric sensor, memory and comparator all on 
the same device and authenticates a subject by comparing the biometric stored in the 
memory to a biometric obtain during an authentication stage. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 

Claims 7-13, 15-18, and 32-34 are objected to as being dependent upon a 
rejected base claim, but would be allowable if rewritten in independent form including all 
of the limitations of the base claim and any intervening claims. 

The following is a statement of reasons for the indication of allowable subject 

matter: 

With respect to claims 7-8, 12-13, and 15-1 8, the cited prior art fails to specifically teach 
generating at least one of a password and another authentication procedure based on 
biometric authentication locally under the subject's control. 



• 



Application/Control Number: 09/372,170 



Page 16 



Art Unit: 2134 

With respect to claims 9-1 1 , the cited prior art fails to specifically teach generating at 

least one of a password and another authentication procedure based on at least one 

biometric feature extracted locally under the subject's control. 

With respect to claims 27-, the cited prior art fails to specifically teach selectively 

completing the authentication with a remote service using a communication port and 

protocol. 

With respect to claims 32 and 33, the cited prior art fails to specifically teach providing a 
unique non-duplicable authentication mechanism on a device associated with said 
subject, said authentication mechanism being constructed so as to be completely 
independent of the biometric, wherein said authentication mechanism is prevented from 
accessing the biometric itself. 

With respect to claim 34, the cited prior art fails to specifically teach biometric 
information for a plurality of subjects is stored in a device associated with the subject. 



THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 . 1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 



Conclusion 
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extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Matthew B Smithers whose telephone number is (703) 
308-9293. The examiner can normally be reached on Monday-Friday (9:00-5:30) EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gregory A Morse can be reached on (703) 308-4789. The fax phone 
number for the organization where this application or proceeding is assigned is (703) 
872-9306. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 




Matthew B Smithers 
Primary Examiner 
Art Unit 2134 



